@@ -1084,19 +1084,37 @@ def cmd_setacl(args):

 	def _update_acl(uri, seq_label = ""):

 		acl = s3.get_acl(uri)

 		debug(u"acl: %s - %r" % (uri, acl.grantees))

-		if cfg.acl_public:

+		if cfg.acl_public == True:

 			if acl.isAnonRead():

 				info(u"%s: already Public, skipping %s" % (uri, seq_label))

-				return

-			acl.grantAnonRead()

-		else:

+				if not cfg.acl_grants and not cfg.acl_revokes:

+					return;

+			else:

+				acl.grantAnonRead()

+		elif cfg.acl_public == False: # we explicitely check for False, because it could be None

 			if not acl.isAnonRead():

 				info(u"%s: already Private, skipping %s" % (uri, seq_label))

-				return

-			acl.revokeAnonRead()

+				if not cfg.acl_grants and not cfg.acl_revokes:

+					return;

+			else:

+				acl.revokeAnonRead()

+

+		# update acl with arguments

+		# grant first and revoke later, because revoke has priority

+		if cfg.acl_grants:

+			for grant in cfg.acl_grants:

+				acl.grant( **grant );

+

+		if cfg.acl_revokes:

+			for revoke in cfg.acl_revokes:

+				acl.revoke( **revoke );

+

 		retsponse = s3.set_acl(uri, acl)

 		if retsponse['status'] == 200:

-			output(u"%s: ACL set to %s  %s" % (uri, set_to_acl, seq_label))

+			if cfg.acl_public == True or cfg.acl_public == False:

+				output(u"%s: ACL set to %s  %s" % (uri, set_to_acl, seq_label))

+			else:

+				output(u"ACL updated")

 	s3 = S3(cfg)

@@ -1108,7 +1126,10 @@ def cmd_setacl(args):

 		for arg in old_args:

 			uri = S3Uri(arg)

 			if not uri.has_object():

-				info("Setting bucket-level ACL for %s to %s" % (uri.uri(), set_to_acl))

+				if cfg.acl_public != None:

+					info("Setting bucket-level ACL for %s to %s" % (uri.uri(), set_to_acl))

+				else:

+					info("Setting bucket-level ACL for %s" % (uri.uri()))

 				if not cfg.dry_run:

 					_update_acl(uri)

 			else:

@@ -1538,6 +1559,10 @@ def main():

 	optparser.add_option("-r", "--recursive", dest="recursive", action="store_true", help="Recursive upload, download or removal.")

 	optparser.add_option("-P", "--acl-public", dest="acl_public", action="store_true", help="Store objects with ACL allowing read for anyone.")

 	optparser.add_option(      "--acl-private", dest="acl_public", action="store_false", help="Store objects with default ACL allowing access for you only.")

+

+	optparser.add_option(      "--acl-grant", dest="acl_grants", action="append", metavar="PERMISSION:EMAIL OR USER_CANONICAL_ID", help="Grant stated permission to a given amazon user. Permission is one of: read, write, read_acp, write_acp, full_control, all")

+	optparser.add_option(      "--acl-revoke", dest="acl_revokes", action="append", metavar="PERMISSION:USER_CANONICAL_ID", help="Revoke stated permission for a given amazon user. Permission is one of: read, write, read_acp, wr     ite_acp, full_control, all")

+

 	optparser.add_option(      "--delete-removed", dest="delete_removed", action="store_true", help="Delete remote objects with no corresponding local file [sync]")

 	optparser.add_option(      "--no-delete-removed", dest="delete_removed", action="store_false", help="Don't delete remote objects.")

 	optparser.add_option("-p", "--preserve", dest="preserve_attrs", action="store_true", help="Preserve filesystem attributes (mode, ownership, timestamps). Default for [sync] command.")

@@ -1647,6 +1672,30 @@ def main():

 			debug(u"Updating Config.Config extra_headers[%s] -> %s" % (key.strip(), val.strip()))

 			cfg.extra_headers[key.strip()] = val.strip()

+

+	permission_re = "(?P<PERMISSION>read(_acp)?|write(_acp)?|full_control|all)"

+

+	if options.acl_grants:

+		r_acl_grant = re.compile( "^%s:(?P<NAME>.+)$" % permission_re, re.IGNORECASE)

+		for grant in options.acl_grants:

+			is_data = r_acl_grant.match( grant )

+			if is_data:

+				data = is_data.groupdict()

+				cfg.acl_grants.append( {'name': data['NAME'].lower(), 'permission': data["PERMISSION"].upper()} )

+			else:

+				warning( u"skipped invalid --acl-grant option: [%s]" % grant)

+

+	if options.acl_revokes:

+		r_acl_revoke = re.compile( "^%s:(?P<NAME>[a-f0-9]+)$" % permission_re, re.IGNORECASE)

+		for revoke in options.acl_revokes:

+			is_data = r_acl_revoke.match( revoke )

+			if is_data:

+				data = is_data.groupdict()

+				cfg.acl_revokes.append( {'name': data['NAME'].lower(), 'permission': data["PERMISSION"].upper()} )

+			else:

+				warning( u"skipped invalid --acl-revoke option: [%s]" % revoke)

+

+

 	## Update Config with other parameters

 	for option in cfg.option_list():

 		try:

@@ -1659,6 +1708,7 @@ def main():

 	## Special handling for tri-state options (True, False, None)

 	cfg.update_option("enable", options.enable)

+	cfg.update_option("acl_public", options.acl_public)

 	## CloudFront's cf_enable and Config's enable share the same --enable switch

 	options.cf_enable = options.enable